[35763] in Kerberos
Re: Windows KDC - Delegation Option
daemon@ATHENA.MIT.EDU (Christopher D. Clausen)
Mon Feb 10 14:46:28 2014
Message-ID: <52F92C85.1060608@acm.org>
Date: Mon, 10 Feb 2014 13:46:13 -0600
From: "Christopher D. Clausen" <cclausen@acm.org>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <CAMeQEL9XMAeo8s2pfUOBxABK9y4ctQMSMVimO+C9wr8pqus93w@mail.gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Try checking the "Account is sensitive and cannot be delegated" option
in the user properties and see if that does what you want. (I'm not
sure if it will or not, but I believe this is the option actually
intended to prevent Kerberos delegation.)
<<CDC
Vipul Mehta wrote, On 2/10/2014 12:50 AM:
> Hi,
>
> Scenario : User A forwards his credentials to User B. User B uses the
> forwarded credentials to interact with User C on behalf of user A.
> [Delegation]
>
> In windows KDC there is delegation option associated with user properties.
> I've set it to "Do not trust this user for delegation" for User B i.e. User
> B will not be able to use delegated credentials.
>
> In Windows SSPI API, it works fine and User B is not able to use delegated
> credentials.
>
> But the option doesn't seem to be having any impact in MIT Kerberos API in
> C++. User B is able to use A's forwarded credentials to establish security
> context with User C.
>
> Is this a problem from KDC side ? Any solution for this ?
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
